Legal
Cookie Policy
Last updated: 13 September 2026 · Version 1.3
1. What are cookies?
Cookies are small text files placed on your device by a website. They allow the site to remember information about your visit, such as whether you are logged in.
2. Cookies we use
| Cookie name | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
breakmesh_session |
Strictly necessary | Keeps you authenticated during your session. Without this cookie the platform cannot function. | Up to 30 days, or until you sign out | BreakMesh (first-party) |
breakmesh_mfa_pending |
Strictly necessary | Temporarily stores your user identity during multi-factor authentication (MFA) verification. Expires after 5 minutes. | 5 minutes | BreakMesh (first-party) |
bm-theme |
Functionality (localStorage) | Remembers your dark/light theme preference. Stored in browser localStorage, not a cookie. |
Persistent (until cleared) | BreakMesh (client-side only) |
bm-cookie-consent |
Functionality (localStorage) | Records your cookie choice ("accepted" or "essential-only"). Stored in browser
localStorage. This is what actually controls whether the analytics cookies
below are set — see the note below. |
Persistent (until cleared) | BreakMesh (client-side only) |
_ga, _ga_* |
Analytics (first-party cookie, set on our own domain) — only if you accept | Google Analytics (GA4), loaded via Google Tag Manager. The cookie itself is first-party (Google's own guidance: GA4's JavaScript sets first-party cookies, not third-party ones), but the information it enables — including a pseudonymous client identifier and device/browser/interaction data — is sent on to Google, which processes and aggregates it into reporting. Used for site usage statistics (pages viewed, traffic sources) — not for advertising or cross-site tracking. We have confirmed our Tag Manager container carries only this tag; no advertising or remarketing pixel is configured. | Up to 2 years (Google's default GA4 duration) | BreakMesh (first-party cookie); analytics data sent to Google LLC |
Corrected note: an earlier version of this policy stated we set no third-party analytics cookies. That was inaccurate at the time — Google Analytics did load unconditionally via Google Tag Manager. Both the claim and the underlying behaviour have since been corrected: neither Tag Manager nor Google Analytics loads at all until you click Accept on the cookie notice; clicking Reject non-essential, or not making a choice, means the analytics cookies above are never set for that visit. We do not use any advertising, remarketing, or cross-site behavioural tracking cookie of any kind, and the Tag Manager container has been confirmed to carry only the analytics tag above.
One narrow edge case: a visitor with JavaScript disabled cannot see or interact with the cookie notice at all, so we simply don't load any analytics tag for that visitor either, rather than loading one unconditionally as a fallback.
3. Third-party cookies
Our payment processors, Razorpay and PayPal, may set cookies on pages where you enter payment information. These are strictly necessary for fraud detection and payment security. Their cookie use is governed by Razorpay's Privacy Policy and PayPal's Privacy Statement respectively. Google Analytics's cookie itself is first-party (see above), but the information it enables is a third-party disclosure to Google, governed by Google's Privacy Policy.
4. How to manage cookies
The session and MFA cookies are strictly necessary — the service cannot function without them. The Google Analytics cookies are optional and are never set until you click Accept on the cookie notice; click Cookie Settings in the footer at any time to reopen the notice and change your choice. You can also block them at the browser level, without losing any platform functionality:
Deleting or blocking session cookies will sign you out of your account.
5. Updates
We will update this policy if we introduce new cookies. Changes will be reflected in the "Last updated" date above, and the consent banner will reappear if we introduce non-essential cookies.
6. Contact
For questions about cookies or data privacy: support@breakmesh.io